Submission Details
Severity:
Staker contract can be drained entirely via claim
Claim() doesn't burn TKN shares
https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Staking.sol#L56
so an attacker can drain all WETH from the contract
POC:
https://gist.github.com/justefg/deb2c1102fd6668405c1ba879567d215
Mitigation Steps:
Burn TKNs
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.